International Business Machines Corporation

Other

Lenovo (singapore) Pte. Ltd.

University of North Carolina at Chapel Hill

Clark Debs Jeffries

Gordon Taylor Davis

Kevin David Himberger

Mohammad Peyravian

Michael Steven Siegel

Everett Arthur Corl, Jr

Marco C Heddes

Jean Louis Calvignac

Andreas Kind

Mark Anthony Rinaldi

Dongming Hwang

Robert W Danford

Malcolm Scott Ware

Ravinder Kumar Sabhikhi

Colin Beaton Verrilli

Brian Mitchell Bass

Jeffrey Haskell Derby

Hua Ye

Youssef Abdelilah

John Fred Davis

Piyush Chunilal Patel

Ken Van Vu

Brahmanand Kumar Gorti

Raj Kumar Singh

Rama Mohan Yedavalli

Metin Aydemir

Alan David Boulanger

Norman Clark Strole

Anthony Matteo Gallo

Andreas Guenther Herkersdorf

Garreth J Jeremiah

Kartik Sudeep

Jitesh Ramachandran Nair

Claude Basso

Fabrice Jean Verplanken

Charles Steven Lingafelt

Natarajan Vaidhyanathan

Jan Van Lunteren

Patrick Droz

Gerald Arnold Marin

Victoria Sue Thio

Steven Richard Perrin

Ganesh Balakrishnan

Ilias Iliadis

Joseph Franklin Logan

Ali Ghassan Saidi

Pascal R Tannhof

Sonia Kiang Rovner

Jeffrey James Lynch

James Johnson Allen, Jr

Kerry A Kravec

Anoop Ghanwani

Jan M Slyfield

Joseph Franklin Garvey

Terry Dwain Escamilla

Robert Barry Sisk

Michael A Walter

Brian E Carpenter

Hoyt Edwin Bowen, Jr

Larry W Nicholson

Kenneth M Farmer

John Ziraldo

Marc A Boulanger

C Marcel Kinard

Avraham Zehavi

Hiroshi Takada

John P Chalmers

Jitesh R Nair

Roman Alexander Pletka

Mircea R Gusat

Minh H Tong

Philippe Damon

Srinivasan Ramani

Allen Leonid Roginsky

Kenneth James Barker

Ross Boyd Leavens

Bernard Metzler

Jeffrey Powers Bradford

Peter Irma August Barri

Grayson Warren Randall

Gail Irene Woodland

Miroslav Vrana

Loren Douglas Larsen

Brooks Johnston

Rosemary Venema Slager

David M McMillen

Francis Michael Bartucca

Lukas Kencl

Atef O Zaghloul

Soenke V Mannal

Olga Golovanevsky

Ivan Oscar Clemminck

Steven Paul Woolet

Phillip Singleton

Plyush C Patel

Brian Edward Carpenter

Jeffery S Hines

Diana Perkins

Vandana Turaga

Randall William Worzella

A method and technique for protecting against denial of service attacks includes maintaining a session count indicating a quantity of active client sessions a server is maintaining and a session threshold specifying a maximum quantity of concurrent client sessions the server can maintain. Responsive to receiving a request from a client, a request count maintained by the server is verified to be less than the session threshold and, if so, a challenge message is sent to the client and the request count is incremented. Responsive to receiving a response message to the challenge message from the client, the response message is verified, a session with the client is established, and the session count is incremented. Responsive to terminating the session with the client, the session count and the request count are decremented.

Front-end protocol for server protection

A method and technique for protecting against denial of service attacks includes maintaining a window over a sequence number space that includes sequence numbers that are sequentially assigned to challenge messages where the window has a leading edge and a trailing edge. Responsive to receiving a request from a client, the leading edge of the window is advanced and a leading edge sequence number is selected as a challenge sequence number. A challenge message including the challenge sequence number is sent to a client. Responsive to receiving a response message from the client, it is verified that a challenge sequence number included with the response message is within the window and does not correspond to a marked sequence number within the window.

The present invention provides for protecting against denial of service attacks. A request is sent by a client, the request comprises client indicia. The request is received at a server. A request count is incremented by the server. A sequence number is assigned as a function of the client indicia. A problem is selected by the server. The problem is sent by the server to the client. A solution to the problem is sent to the server. It is determined if the solution by client is correct. If the solution is correct, a session is performed. If the solution is not correct, the request is discarded. This can substantially decrease the amount of attacks performed by a rogue client, as the session set-up time can be substantial.

A method, system, and/or computer program product manages a distributed denial of service attack in a multiprocessor environment. A determination is made of (a) a first upper threshold for a normal number of packets from the multiprocessor environment to multiple destination addresses, (b) a second upper threshold for a normal ratio of the packets from the multiprocessor environment to a single destination address compared to the packets from the multiprocessor environment to the multiple destination addresses, and (c) a third upper threshold for a normal ratio of packets from the multiprocessor environment to a single port at a single destination address compared to packets from the multiprocessor environment to the multiple destination addresses. In response to the first and second thresholds being exceeded, a specific port is monitored to determine if the third upper threshold is being exceeded at that port, thus indicating an apparent distributed denial of service attack.

Managing a DDoS attack

The present invention relates to methods of isolating and culturing autologous pluripotent stem (aPS) cells. The present invention also provides isolated aPS cells, populations of aPS cells and cultures of aPS cells. Further provided are culture media for expanding aPS cells and methods of culturing aPS cells. The invention also provides for the use of aPS cells, e.g., for diagnostics, drug evaluation and screening, and regenerative medicine.

Isolation, expansion and use of autologous pluripotent stem cells

Managing e-mails from a source suspected of sending spam. The e-mails are received at a firewall or router en route to a mail server. A determination is made whether a source has sent an e-mail which exhibits characteristics of spam. In response, subsequent e-mails from the source destined for the mail server are rate-limiting at the firewall or router such that the firewall or router limits a rate at which the subsequent e-mails are forwarded from the firewall or router to the mail server. The rate limit can be a limit on a number of e-mails per unit of time from the source that will be forwarded from the firewall or router to the mail server.

System, method and program to limit rate of transferring messages from suspected spammers

A system, method and program product for blocking unwanted e-mails. An e-mail is identified as unwanted. A source IP address of the unwanted e-mail is determined. Other source IP addresses owned or registered by an owner or registrant of the source IP address of the unwanted e-mail are determined. Subsequent e-mails from the source IP address and the other IP addresses are blocked. This will thwart a spammer who shifts to a new source IP address when its spam is blocked from one source IP address.

System, method and computer program to block spam

A method of, system for, and product for managing a denial of service attack in a multiprocessor environment comprising. The first step is establishing normal traffic usage baselines in the multiprocessor environment. Once the baseline is established the next step is monitoring outgoing traffic to detect a high proportion of packets being sent to a specific destination address, and a high number of outbound packets compared to said baseline. Next is monitoring ports and protocols to detect a high proportion of packets sent to a specific port, and a consistent use of a protocol for all packets for that port. If there is such consistent use of a protocol for all packets for that port as to evidence a denial of service attack, blocking measures are started to mitigate the apparent denial of service attack.

Detection of grid participation in a DDoS attack

An intrusion detection system (IDS) comprises a network processor (NP) coupled to a memory unit for storing programs and data. The NP is also coupled to one or more parallel pattern detection engines (PPDE) which provide high speed parallel detection of patterns in an input data stream. Each PPDE comprises many processing units (PUs) each designed to store intrusion signatures as a sequence of data with selected operation codes. The PUs have configuration registers for selecting modes of pattern recognition. Each PU compares a byte at each clock cycle. If a sequence of bytes from the input pattern match a stored pattern, the identification of the PU detecting the pattern is outputted with any applicable comparison data. By storing intrusion signatures in many parallel PUs, the IDS can process network data at the NP processing speed. PUs may be cascaded to increase intrusion coverage or to detect long intrusion signatures.

Intrusion detection using a network processor and a parallel pattern detection engine

A system, method and program product for managing e-mails from a source suspected of sending spam. The e-mails are received at a firewall or router en route to a mail server. A determination is made whether a source has sent an e-mail which exhibits characteristics of spam. In response, subsequent e-mails from the source destined for the mail server are rate-limiting at the firewall or router such that the firewall or router limits a rate at which the subsequent e-mails are forwarded from the firewall or router to the mail server. The rate is predetermined and less than a maximum rate at which the firewall or router can physically forward e-mails to the mail server absent the rate limit. A determination is made whether another source has sent another e-mail which exhibits more characteristics of spam than the first said e-mail. In response, subsequent e-mails from this other source are blocked at the firewall or router. The rate limit can be a limit on a number of e-mails per unit of time from the source that will be forwarded from the firewall or router to the mail server.

A method and system for managing asynchronous transfer mode (ATM) traffic in a computer system is disclosed. The computer system is used in sending, receiving, or sending and receiving a plurality of ATM flows. Each ATM flow has a plurality of ATM cells, a minimum ATM bandwidth guarantee, and a maximum ATM bandwidth. The method and system include determining whether excess bandwidth exists for the ATM flows. The method and system also include gracefully increasing a portion of the ATM cells transmitted for each ATM flow during periods of excess bandwidth. The portion of the ATM cells transmitted is not more than the maximum ATM bandwidth limit. If an ATM flow presents a sufficient offered load, the portion of the ATM cells transmitted in the flow is not less than a minimum ATM bandwidth guarantee.

Controlling ATM traffic using bandwidth allocation technology

A method for managing attacks in a computer system is disclosed. The computer system is used in sending, receiving, or sending and receiving a plurality of packets, which include a plurality of administrative packets. The method includes determining whether a congestion of the administrative packets exists. Congestion of the administrative packets indicates that a potential attack exists. The method also includes discarding a portion of the plurality of administrative packets if it is declared that the congestion of the administrative packets exists. The portion of the plurality of packets is sufficient to ensure that a remaining portion of the plurality of packets transmitted is not more than a maximum administrative packet bandwidth limit and, if the plurality of administrative packets present a sufficient offered load, not less than a minimum administrative packet bandwidth guarantee.

Method for managing of denial of service attacks using bandwidth allocation technology

The decision within a packet processing device to transmit a newly arriving packet into a queue to await further processing or to discard the same packet is made by a flow control method and system. The flow control is updated with a constant period determined by storage and flow rate limits. The update includes comparing current queue occupancy to a threshold. The outcome of the update is adjustment up or down of the transmit probability value. The value is stored for the subsequent period of flow control and packets arriving during that period are subject to a transmit or discard decision that uses that value.

Retro flow control for arriving traffic in computer networks

A method for increasing the capacity of a connection table in a firewall accelerator by means of mapping packets in one session with some common security actions into one table entry. For each of five Network Address Translation (NAT) configurations, a hash function is specified. The hash function takes into account which of four possible arrival types a packet at a firewall accelerator may have. When different arrival types of packets in the same session are processed, two or more arrival types may have the same hash value.

Efficiently hashing packet keys into a firewall connection table

Growing community of inventors

Durham, NC, United States of America

Clark Debs Jeffries